Fixed array out of bounds in CallResolver (#548)

Fraunhofer-AISEC · Sep 1, 2021 · a7c378e · a7c378e
1 parent a915f63
commit a7c378e
Showing 1 changed file with 13 additions and 12 deletions.
diff --git a/cpg-library/src/main/java/de/fraunhofer/aisec/cpg/passes/CallResolver.java b/cpg-library/src/main/java/de/fraunhofer/aisec/cpg/passes/CallResolver.java
@@ -891,9 +891,7 @@ private List<FunctionDeclaration> resolveWithImplicitCast(
   private List<FunctionDeclaration> resolveWithImplicitCastFunc(CallExpression call) {
     assert lang != null;
     List<FunctionDeclaration> initialInvocationCandidates =
-        lang.getScopeManager().resolveFunctionStopScopeTraversalOnDefinition(call).stream()
-            // .filter(f -> !f.isImplicit())
-            .collect(Collectors.toList());
+            new ArrayList<>(lang.getScopeManager().resolveFunctionStopScopeTraversalOnDefinition(call));
     return resolveWithImplicitCast(call, initialInvocationCandidates);
   }
 
@@ -909,15 +907,18 @@ private void checkMostCommonImplicitCast(
       List<CastExpression> implicitCasts, List<CastExpression> implicitCastTargets) {
     for (int i = 0; i < implicitCasts.size(); i++) {
       CastExpression currentCast = implicitCasts.get(i);
-      CastExpression otherCast = implicitCastTargets.get(i);
-      if (currentCast != null && otherCast != null && !(currentCast.equals(otherCast))) {
-        // If we have multiple function targets with different implicit casts we have an
-        // ambiguous call and we can't have a single cast
-        CastExpression contradictoryCast = new CastExpression();
-        contradictoryCast.setImplicit(true);
-        contradictoryCast.setCastType(UnknownType.getUnknownType());
-        contradictoryCast.setExpression(currentCast.getExpression());
-        implicitCasts.set(i, contradictoryCast);
+
+      if(i < implicitCastTargets.size()) {
+        CastExpression otherCast = implicitCastTargets.get(i);
+        if (currentCast != null && otherCast != null && !(currentCast.equals(otherCast))) {
+          // If we have multiple function targets with different implicit casts we have an
+          // ambiguous call and we can't have a single cast
+          CastExpression contradictoryCast = new CastExpression();
+          contradictoryCast.setImplicit(true);
+          contradictoryCast.setCastType(UnknownType.getUnknownType());
+          contradictoryCast.setExpression(currentCast.getExpression());
+          implicitCasts.set(i, contradictoryCast);
+        }
       }
     }
   }